CCIE R/Sv5 Failed - And Not Going Back

My post about starting the CCIEv5 journey is here.

Since I passed the CCIE Route/Switch written exam eight months ago, I've been studying at least two hours six days a week. On the weekends I've tried to set aside more time, sometimes a lot more - around six to eight hours of studying. I also work as a network engineer for my day job for a services provider, so I spend lots and lots of time thinking about and actually applying my networking skills.

The more I work with networks, the more comfortable I've become with the subject, and after passing the written exam and putting in study time, I decided to book the grueling 8.5-hour lab exam for May 15 in San Jose, California.

As soon as I booked the exam I amped up my studying. No more lunches out - I'd rather stay at my desk, eat this dry sandwich and run GNS3 simulations on my personal laptop. Sorry I can't stay out very long, I've got to get back to my studying at home.

I set up complex labs from INE in GNS3, sometimes hooking them up to physical switches to run the switch-only features - ASICs, hardware, and VTP configurations that aren't yet possible in a GNS3 virtual environment. The INE materials are fantastic - the troubleshooting sections are devilishly difficult, and the configuration sections remarkably resembled the lab exam.

Studying at this level is more than a commitment or a part-time job - it's a relationship. One which can be significantly rewarding, but also one of deep stress and anxiety as the date for this difficult exam approaches.

Traveling to San Jose, aka Labs on a Plane

I decided to take my wonderfully supportive wife Lindsey along with me to San Jose, the site of my CCIE exam. I thought that no matter my pass or (probable) failure, Lindsey and I could enjoy a great weekend with friends and exploring around California.

Fourteen months after passing the written exam, Lindsey and I boarded a plane. We flew down Wednesday night late, two days before the test on Friday. I ran through INE labs. All day Thursday I set aside for relaxing and not thinking about studying. I managed to stay away from studying with Lindsey's help for all but an hour, during which I read configurations and sweated. We visited the Cisco site and found the exam center.

I fell into a kind of anxious zen. I knew that the test was just around the corner, but I forced myself to think about the 3,000+ hours I've spent studying this material and breathe.

Test Day (Don't Freak Out)

On Friday morning Lindsey drove me in and dropped me off about 20 minutes early. The traffic was light and the weather was cloudy. I felt excited, anxious, and curious for the upcoming exam. After all, I've been thinking about this exam for 14 months!

The exam was, for the most part, incredibly fun. I'm unable to discuss exam specifics due to Cisco's NDA, but I can say the simulations and questions were, for the most part, exactly what the INE and Cisco Press materials had prepared me for. Routing protocols overlapped; complicated, nuanced questions were asked. I enjoyed the test.

Typical question sets have six objectives per segment. Five of these objectives are highly specific, but tasks that most CCIE-level engineers will be able to answer with careful planning. The sixth is typically a highly nuanced and exacting request about the topic in question. Because of the all-or-nothing style of CCIE exams, each section must be passed in full or not at all, so if you're unable to answer this obscure request, you have not only missed out on all points, but you have wasted very valuable time. Planning is of utmost importance here.

The actual environment was similar to what I imagine a white-collar prison is like. One person is able to use the bathroom at a time. All candidates are treated with suspicion and sometimes hostility if they break a rule. For lunch, the proctor clapped at us to stop our configuration and paraded us out of the computer area and locked the door behind us so we could enjoy 20 minutes of some type of pasta.

I kept on-pace as well as I could, and was able to complete most tasks with careful thought and quick typing. At each section, these nuanced, exacting questions were a challenge, and I was able to complete only some of them.

When the time finished up, I walked out, emotionally, mentally, and physically exhausted. I knew there was a very slim chance that I passed, but I allowed myself some hope. I sat on a bench outside the Cisco campus and called my wife to come pick me up.

Aftermath

I spent the rest of the weekend relaxing with my wife and enjoying our time with friends. For the first time in a very long time, I was present with my wife. I wasn't doing any subnetting or route distribution in my head. I saw a bit more clearly the woman I fell in love with, who I'd been more or less ignoring for the past few months as my studying had kicked into high gear.

In the end, I failed. I passed the first section (Troubleshooting), but failed the Diagnostic and Configuration section of the exam. My configuration sections came back as mostly 0%s - I must have broken a lab rule at some point to get all my work zeroed out. Due to Cisco's confidentiality around the exam, they did not inform me which, if any, rule was broken.

To this point I thought I'd take a few days of relaxing at home and then go back. I'm still confident that I could eventually pass the CCIE - I'm guessing on the third attempt. That attempt would be something like 6 months from now, with constant studying (4-5 hours per day on weekdays, maybe 10-12 on weekends), and about $5,000 MORE dollars. Not to mention the 6 more months of ignoring my wife and my other passions due to this behemoth of a goal.

I Choose Me

In the end, I'd rather have my wife, time, and happiness back. I am still passionate about network engineering, but not to the exclusion of the other parts of my ambition and life! I am passionate about computer security, travel, and enjoying the limited time we all have here.

So goodbye, CCIE number ~#50,000. I have learned an incredible amount, and reaped enormous benefits in my career as I've progressed. I appreciate you for all that you've given me, but you ask too much.

Thanks for the good times, Cisco CCIE. I won't be back.

If you are planning to take the CCIE exam, good luck to you! Next for me is the CompTIA Security+, Certified Ethical Hacker, and then CISSP.
kyler

CCIE Route/Switch v5: Great, Cheap Labs Book

Hey all!

Been a while since my last post. I've been spending time doing these large-scale labs. A great one for those with a subscription to CBTNuggets (which I highly recommend), you can check out one of my earlier posts that goes over their full-scale practice CCIEv5 lab.

But once that was done I started looking for more practice labs for download, or rented lab equipment, and I found a few, but most are very expensive - $400+ for a few labs. If all the practice labs you look at are at that cost, it's going to be a very expensive practice for a very expensive test.

I've just finished all 3 labs out of Martin J. Duggan's Cisco Press practice book, and I have to say, they are very well done. Lab 1 and 2 are perfect. Most can be completed (mostly) with GNS3. There are, of course, some switching technologies that you'll need to either do on a real switch or rent some lab equipment for because GNS3 doesn't (yet) virtualize switch ASICs.

In any case, you can find this book here on Amazon for $86. It also includes a bunch of troubleshooting practice examples. Highly recommended. Please check it out yourself!
kyler

CCIE Route/Switch v5 GNS3 Lab: DMVPN QoS Profile (Micro-Lab)

Hey all!

Just a tiny lab today to cover one line of the CCIEv5 study guide: DMVPN QoS Profiling per-group from the head-end.

It's a very flexible technology that allows you to assign groups from the DMVPN 'spokes' and QoS policy from the DMVPN head-end (hub).

In this lab I've build a very small DMVPN which works perfectly, but lacks per-group QoS policy. You've been asked by your senior network engineer to add this, what she thinks will be a quick task.

Here's your topology: Go!

You can download the solved and unsolved lab here: http://1drv.ms/Zgmfpf. Try it yourself!

Please note that the 'solved' version shows a DMVPN policy which is different between each client DMVPN router. You could just as easily assign all client DMVPN tunnels to the same group, and control them all with the same policy. This lab shows how granular you can be.

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: GRE P2P Tunneling and DMVPN over GRE

Hey all!

GRE tunneling is a fascinating topic. To a host traversing a GRE tunnel, the hops are transparent. A router that doesn't support a protocol can be made to route it with no changes to the older router - just encapsulate it in something the older router understands and you're good to go. And the commands for a DMVPN and P2P GRE tunnel can be written in such a way that they can be simply copy and pasted to a new router to have it dial in, peer with your IGP, and start injecting routes. It's an incredibly simple and powerful tool which allows for good security.

With the way corporate hacks are becoming bigger news items every day, I'd think any network engineer worth their salt is going to want to know how to encrypt traffic between controlled routers for just about everything. Even on private networks we now know the government is listening and copying data for analysis, and I'm just not cool with that. Call me a liberal, but I think our right to freedom from illegal search and seizure means something. And here's a way you can enforce it.

In the following topology I had a few different technologies to setup, so I created a clover-leaf type topology, where each leaf is a different tech, and you bridge them in the middle for seamless routing. I wrote out hopefully good instructions and requirements, as well as validation steps that should help those of you working the 'Unsolved' version, which you can download below.

Here's the topology:

Download the solved and unsolved versions here: http://1drv.ms/1rViikp

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: BGP Pathing, Scalability, Summarization (+ BONUS MPLS VPN, VRF)

Hey all,

This GNS3 lab covers a breadth of BGP and MPLS topics:
BGP pathing and route preference
BGP scalability using route-reflectors and peer-groups
BGP summarization and redistribution
MPLS VPN config using a redundant route-reflector config and private VRFs (similar to what ISPs use to create private networks for their customers)
MPLS basic interface config

The 'unsolved' version (which you can download below) has the IGPs and IPs configured for both the ISP network and both the HQ and remote network for CompanyA, which has asked you to come in and configure the BGP portions. Because you also work for the ISP, you'll need to configure their MPLS and BGP, configure an MPLS VPN, and configure private VRFs to keep the company's traffic separate. It's a big job - get started!

The topology looks like this:

You can download both the solved and unsolved GNS3 lab here: https://1drv.ms/f/s!AliOPzHSO-GngbgZiNH9YSAZv6hbhw

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: OSPF IPv4 and IPv6 Neighbors, Network Types, and Path Selection

Hey all!

This lab covers OSPF on top of IPv4 and IPv6 to establish neighbors using different network types, tune those neighbors to converge in sub-second increments, and shows how you can use ospf interface cost to change the path OSPF selects to route packets around your network.

It's a really fun lab to build and work with, and I recommend you attempt it yourself! The solved and unsolved versions are available for download at the link below

Here's what it looks like:

You can download the lab here: http://1drv.ms/1vBv3U9

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: BGP Peers, RouteReflectors, Scalability

Hey all,

This lab covers a portion of the BGP section of the CCIEv5 R/S study guide. This topology covers an OSPF topology with a BGP overlap, split into different sub-ASs inside a confederation. This allows a single route reflector to be assigned per sub-AS and relationship requirements are greatly reduced. Each sub-AS uses a different method of scalability - a method of reducing configuration lines and managing groups of neighbors at once.

Here's the topology:

Download the completed version here: http://1drv.ms/XWWcmQ

Enjoy!
kyler

CCIE Route/Switch v5 GNS3 Lab: EIGRP Named Instances

Hey all,

So EIGRP is a great IGP -- it's fast, flexible, and supports a ton of options to help you run your business network easily. Cisco works hard to keep that up. And in late 2012/early 2013, they introduced a mode to help make it even easier to keep EIGRP instances straight: Named Instance mode. It allows for names to be assigned which help sort purposes and keep things in order, and allows the 'old'-style of EIGRP instances to be 'nested' inside these named instances. It sounds confusing, but it's simple in practice.

I organized the lab like a problem ticket, ala the CCNP T-Shoot exam and CCIE route/switch.

The lab request: Amazon and Microsoft's Bing division need help. They are running EIGRP to connect their businesses, and need someone to configure it. One of their VPs heard about this great 'named' mode of EIGRP and wants you to do that. He has created the names for you to use, and wants your company to configure it. They don't care about leaking routes, and just want to get this working yesterday. It's your job. Go!

You can download the solved and unsolved GNS3 labs , as well as the image file for a 7200 router I used for this lab. Download that all here: http://1drv.ms/1tmJhWE

Good luck!

kyler

CCIE Route/Switch v5 GNS3 Lab: Routing Protocol Authentication

Hey all,

This is again a pretty straight-forward lab where I set up simple four-node IGP networks (EIGRPv4, OSPFv2, OSPFv3) and then turn on authentication between the neighbors. It's something you should definitely be doing in your own production network to obfuscate your routing updates and keep unauthorized members from joining your IGP hive-mind.

I'll do something interesting on this one (and maybe on future labs). I'll post both the completed lab, like I've been doing previously, as well as an incomplete one with basic topology setup so you can complete it yourself.

The topology follows and you can find the download links below it.

Find both the incomplete and complete download here: http://1drv.ms/1s1g0hp

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: Policy-Based Routing

Hey all!

This mini-lab covers PBR (Policy-Based Routing), a super-cool feature that allows different hosts or subnets to be routed to different destinations. It's a great tool when you have some hosts or services which you'd like routed out a different internet connection, or possibly through a SPAN services.

Honestly, this lab is pretty simple compared to the series I've been posting, but I find PBR so COOL I decided to make it its own post. I also stripped out my own solution, so you are free to solve this one yourself. You can find the answers by highlighting at the end of this post. Hope you enjoy!

You can download the topology here: https://1drv.ms/f/s!AliOPzHSO-GngahR8F1LsAfLZ9MTfQ

Good luck!
kyler

Solution:
R1#

access-list 92 permit 10.10.10.2

access-list 95 permit 10.10.10.5

!

route-map PBR1 permit 10

 match ip address 92

 set ip next-hop 200.10.10.2

!

route-map PBR1 permit 20

 match ip address 95

 set ip next-hop 100.10.10.2

!

route-map PBR1 permit 30

!

interface FastEthernet1/0

 ip policy route-map PBR1

CCIE Route/Switch v5 GNS3 Lab: Advanced IPv4 PIM, MSDP

This blog covers the CCIEv5 section entitled: "2.2.b Implement and troubleshoot IPv4 protocol independent multicast" as well as "2.2.c Implement and troubleshoot multicast source discovery protocol."

It covers a larger network of routers connected with the different varieties of PIM. Cisco's implementation of PIM supports the following modes:

PIM Dense Mode: This is closer to the original method of PIM, where all network locations are assumed to be part of the multicast. At a specific interval (3 minutes by default), traffic is flooded into a network segment, and the switch/router has to opt-out, and then the timer starts again. If you're watching this on a network monitor it looks like highly regular traffic spikes when multicast traffic is flooded.

PIM Sparse Mode: This version of PIM supports SSM (Source Specific Multicast) by default, and automatically routes traffic down the least costly path, directly from source to destination, instead of routing everything through the RP. It also assumes that hosts don't want to receive traffic, and clients must continually update their membership in the multicast group, or they are excluded.

PIM Sparse-Dense Mode: A mode that originated from migration scenarios from sparse to dense mode. Supports both, and upgrades to sparse mode when an RP is configured or located with auto-RP.

PIM Bidirectional Mode: This version of PIM is a mixture of sparse and dense mode oriented towards a large number of sources and destinations. It's targeted towards organizations that see great numbers of both, so many that the stability of their routers might be affected if using vanilla sparse mode.

RPs are elected automatically via Cisco's proprietary Auto-RP. This is supported on most Cisco routers, but if you're working with other types of routers or a mixed group, you can use the open source variety called BSR.

Auto RP allows PIM members to dynamically discover candidate RP nodes, instead of having them be statically configured. It allows for a more flexible network in the event of a failure or change, though not nearly as fast as an IGP - default 3 minutes failover time. Basically, there are two roles: RP Candidates, which are usually near the network or traffic flow core, and mapping nodes, which listen for RP candidates and communicate to PIM member nodes which ones to use. This allows for a distribution of tasks and processing, although both consume relatively low processing power.

BSR (Boot Strap Router): Very similar to AutoRP, except easier to configure and supported on most types of routers as an open standard. Maybe not quite as feature-riffic, but fits most use cases.

Here's my topology:

You can download it here: http://1drv.ms/1lc5jdN

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: IPv6 Addressing, Subnetting, and IPv6 Multicast

This is a rather simple topology focused on different IPv6 addressing methods. There's a surprising amount of them:

EUI-64 Addressing: An addressing method for IPv6 where an engineer configures the subnet, and then tells the router to figure out its own host ID based on the local MAC address. Because of the large subnets supported by IPv6, this method of addressing is both possible, simple, and scaleable.

IPv6 Stateless AutoConfig/SLAAC: Hosts (or other router devices, if required) listen for RAs from an available router and copy the network/subnet address and add their own client address to the end (which they base on their MAC address if they can).

IPv6 Global Prefix: A shortcut on Cisco routers which allows a 'global' or 'organization' subnet to be set, which allows all local interfaces on that same router to be addresses with short-hand, instead of typing the entire address.

IPv6 Multicast Routing: Along with a new subnet range, PIM has been optimized for IPv6. It's also assumed to be on, and runs by default in sparse mode. There's very little config to set it up. Unfortunately there's no support yet for auto-rp, so route-points need to be set up manually, and each network device will need to be touched if there's ever a change. There is redundancy, though, by configuring multiple on each device - a manual but effective process.

Manual Addressing: That's not to say you can't just manually specify each octet (?) of your devices. A related thread: The groups are no longer 8 (oct-et) bit groups. Since IPv6 is based on hex, each grouping is worth 16 bits. So I guess they're.. hexakaidec-tet. But that's a really long name, so I'll continue calling it an 'octet,' unspecific as that is.

You can download the configuration here, with tasks labeled: http://1drv.ms/1rHb1SJ

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: Multiple Default Routes

I recently discovered a secondary internet connection at our DR site. We have a private line between our sites, as well as another MPLS connection at our DR site.

I decided to built an automatic failover in case our internet or even the an entire site goes down, which is a wickedly complex problem. There is two-way redistribution between MPLS (which connects both sites) and our private link which runs EIGRP (obviously connecting both sites).

My solutions involves:
* Each gateway router running EIGRP has a default route based on a tracker. The trackers on each are a ping-check every 3 seconds to a public IP, which is forced (with a /32 static route) down a specific interface.
* Each gateway injects their default route when available into EIGRP with a route-map to set the default-route to a different value. The DR site's default-route adds 1,000,000 to the metric so no routers will use it. That number will vary based on the complexity of your company's topologies.
* Each BGP gateway router injects EIGRP routes into BGP with a route-map. That default route at our main site is set at metric 50 (remember, BGP's metric winner is lowest). The DR site prepends the local AS-number a few times to make sure it is a less desirable option than the primary MPLS site, and will only be used if the primary is down.

An internet connection failure can be simulated by shutting the loopback that's IP'd 8.8.4.4 on either ISP router.

The topology requires many of the elements in our production network, so it's more complex than usual - 19 routers.

Download the files and GNS3 topology here: http://1drv.ms/1kuDUmU

CCIE Route/Switch v5 GNS3 Lab: Infrastructure Security

Hey all,

This lab contains a whole lot of layer2 and layer3 infrastructure security features likes ACLs, RPF (reverse path forwarding checks), snmp controls, etc. GNS3 doesn't simulate switching features as well as routing, so some of what I wanted to do I wasn't able to. Some of that is documented in text on the right side of the lab where it can be read and still learned.

These labs are all based around subject matter defined in the CCIEv5 lab blueprint. The full workup is here: http://www.cisco.com/web/learning/exams/docs/ccieRS_Lab5.pdf (Cisco login required to view).

In any case, this lab contains an OSPFv3 IPv6 network bridged to an IPv4 EIGRP network, with these security features intertwined. I recommend looking at the requirements page and then deleting/renaming the local configs that I've uploaded. Then see if you can meet the requirements on the GNS3 file. Once done, compare your results to mine and see if we solved it a different way. Remember, there are always multiple ways to solve each problem, in real life and in the lab.

You can download the lab files and configs here: http://1drv.ms/1pfKL2g

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: IGMP/PIM/AutoRP

Hey all,

This lab covers IGMP and PIM sparse-dense mode. I didn't delve much into sparse-mode and dense-mode PIM because they're all so similar -- a simple designation of mode, and they're configured. The main difference is whether the system assumes all nodes want the traffic (dense mode) or whether they assume everyone doesn't want the traffic (sparse-mode). Sparse-dense is an extension of PIM that allows a node to adapt to the group which it joins -- it defaults to dense mode but if a RP is known or configured for a group, it switches to sparse mode.

I also configured auto-rp, so all nodes will automatically learn the address of a route-point, and redundancy can easily be built into the system. This required one node to be configured to enter its candidacy for RP (or as many nodes as you want), and at least one rp-mapping agent. This agent doesn't have to be a RP candidate, and there can again be multiple configured. It'll listen for candidate RPs and advertise those to the regular members of PIM who are listening for information from them. You can learn more about Cisco sparse/dense/sparse-dense mode here: http://goo.gl/ZBZyoY

Download the GNS3 Lab toplogy with configurations here: http://1drv.ms/1qlAuFj

CCIE Route/Switch v5 GNS3 Lab: CBT Nuggets Practice Lab

Hey all,

This lab is a lot of fun. I've been using CBTNuggets to study for the CCIE, and Jeremy Cioara (who, by the way, is a GENIUS) teaches a great course that's just a practice CCIE lab that he walks you through.

He recommended doing it yourself first to see if you could and I got all the way through it -- with a few exceptions. I posted it here for others to check out, and maybe learn from -- I didn't check most of my work against Jeremy's, so I imagine I solved some of the problems in different ways.

It's pretty ridiculous what you're asked to do -- very complex, overlapping technologies. Click on the picture below to see the entire topology that I used. Jeremy didn't provide one, so I built one myself.

You can download the unsolved as well as my version of the solved GNS3 lab below!

The GNS3 video series is here: https://www.cbtnuggets.com/it-training-videos/course/cisco-ccie-routing-switching-practice-lab <-- This requires a subscription, but you can check out the first minute or two of each video for free as a sample. You'll need to subscribe to get access to CBTNugget's great full lab topology and instruction requirements, but consider the solved as a taster for what you'll be asked to do.

Download both the solved and unsolved versions of the GNS3 lab here: http://1drv.ms/1jGAtsE.

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: Layer2 WAN Technologies

A lab which covers HDLC and PPP encapsulation, CHAP and PAP authentication, MLPPP to multiplex serial connections like T1 lines, and PPPoE, the common authentication and negotiation protocol used for at-home DSL connections.

You can find the lab here: http://1drv.ms/1yz4tKt

Good luck!
kyler

CCIE Route/Switch v5 GNS3 Lab: MPLS VPN

Hey all,

As I lab practice for the CCIE, I think I'll upload my configuration samples and labs so you all are able to see them.

This lab covers a complete MPLS setup including private VPNs spanned across an MPLS cloud. It also includes the configuration many companies deploy at remote sites to redistribute their local site configurations into the MPLS VRF in order to use IGPs (this lab uses OSPF and EIGRP).

Lab is here: http://1drv.ms/1OFvMhw

Enjoy!
kyler

CCIE Lab - Back To Business

My post to finish out my CCIE journey is here.

Alright -- I passed the CCIE route/switch written. Which is awesome. There is a great deal of information and concepts in that test, and all the tests and study that've brought me to this point. I'm proud of myself and my accomplishment. My total is around 1600 hours of study thus far.

Damn right I'm proud

But that's behind me. I've taken two weeks off, and now it's time to start getting ready to face the dragon. The CCIE route/switch lab is a heck of a test. 8 hour long practical in a distant state, with many different rules and requirements that cost points and can fail an exam.

The failure rate on the first attempt is 90-95%
The failure rate for any attempt is around 80%

I've been using video on demand through CBTNuggets, and I've bought several books that cover the certification. Every single one says to expect to fail. The odds are so harsh, and it's so hurtful to a tester's confidence to expect to succeed and then fail, they all say that the first try is a 'practice' attempt.

A $1600 practice attempt!

I don't intend to take this test twice, but I'm not going to let that eat at me. The goal is to get the certification. If I have to test twice, 3x, 4x, I'm going to get it. But my wallet and my lovely wife would be thankful if, on this first attempt, I'd fall into that exceedingly qualified 5-10% that pass on the first try.

So it's back to studying. My studying schedule for around the past 18 months has been unchanged:
* M-F - study over my lunch hour, then 7-9:30 after work
* Saturday: Study 9-3, date night with Lindsey
* Sunday: 9-3, house chores, groceries, cooking

A part-time job would consume less time

It's almost 30 hours each week if I stick to my schedule. I invariably skimp on a single night, or take some extra time off to spend time with friends, but it's close.

The goal is still to get the CCIE number by Thanksgiving of this year. It's an aggressive, challenging goal. If I make it, I'll be around CCIE #50,000 in the world.

Wish me luck!
-kyler